nixCraft

People,

Hope you all know about SSH port forwarding.

I have been wondering about how can we restrict SSH port forwarding.

I have seen a gateway-login server which allows forwarding to a particular host/port only. What I mean by this is that this particular ssh-server allows port forwarding to an IMAP port on an email server in the internal network.

Ppl who want to check their emails just login to the gateway and they can set their IMAP server address as localhost:24443 which gets redirected to thatserver:443

This is a bit odd as we can do forwarding to only the email-server/IMAP port and nothing else.

When I try to do a port forward to some other machine / other port, it just doesn't happen.

#man sshd_config doesn't have any information about restricting portforwardings.

Any clue?

ricc

Some commercial server implementations do have options like
AllowForwardingPort number
DenyForwardingPort number
AllowForwardingTo 3000
DenyForwardingTo 8080

However latest version of OpenSSH comes with permitopen="hostort"
It will limit local ssh –L port forwarding such that it may only connect to the specified host and port.

For example, if you want to allow port forwarding to a remote imap server called "server.nixcraft.in", add permitopen="server.nixcraft.in:143". See man page for example.

__________________
Vivek | My personal blog
Linux Evangelist
Play hard stay cool

Hi, is there a way to restrict remote port forwarding ports (-R) for a single user?